Related Commands

Many commands support the -h keyword (a.k.a. option) to display syntax usage

arp

The arp command relates to the ARP cache on the MARS Appliance. You can view the list of mappings, clear an entry, or add a new mapping.

To display the current entries in the ARP cache, enter:

arp

To display the cached entries for a specific host, enter:

arp [-evn] [-H type] [-i if_local] -a [hostname]

To add a host to the cache, enter one of the following commands:

arp [-v] [-Htype] [-i if_local] -s hostnamehw_addr[netmask] pub

arp [-v] [-Htype] [-iif_local] -s hostnamehw_addr[temp]

arp [-v] [-Htype] [-i if_loca] -Ds hostnameif_dest[netmask] pub

To delete a host from the cache, enter:

arp [-v] [-i if_local] -d hostname[pub | nopub]

Syntax Description

no keyword, options, or arguments

Displays the IP address, hardware type, interface name, and MAC address associated with the network interface in the MARS Appliance.

-H type

When setting or reading the ARP cache, this optional parameter identifies which class of entries (hardware type) ARP should check for. The default value of this parameter is ether. The list of valid type values is as follows:

Displays the entries of the specified hosts. If the hostname parameter is not used, all entries are displayed.

-d hostname

Delete any entry for the specified host.

-D

Use the interface if_dest's hardware address.

-e

Shows the entries in default (Linux) style.

-i If_local

Select an interface in the appliance. When dumping the ARP cache only entries matching the specified interface are printed. When setting a permanent or temp ARP entry, the entry is associated with this interface; if this option is not used, the routing table is used to determine the most likely interface through which the address is reachable. For pub entries the specified interface is the interface on which ARP requests are answered. This value must be different from the interface to which the IP datagrams will be routed (if_dest).

-shostnamehw_addr

Manually create an ARP address mapping entry for host hostname with hardware address set to hw_addr class. For the Ethernet class, use the 6-bytes in hexadecimal notation, separated by colons. You can determine this value using the ipconfig /all command on the host for which you are defining this entry. When adding proxy arp entries (that is, those with the publish flag set), a netmask may be specified to proxy arp for entire subnets. If the temp flag is not supplied entries are permanently stored in the ARP cache. You cannot define an ARP entry for an entire subnet.

Usage Guidelines

In all places where a hostname is expected, you can alternatively enter an IP address in dotted-decimal notation.

As a special case for compatibility the order of the hostname and the hardware address can be exchanged.

Each complete entry in the ARP cache is marked with the C flag. Permanent entries are marked with M and published entries have the P flag.

Note You cannot add arp entries from a file, as you do not have access to the file system on theMARS Appliance.

Examples

To permanently add an arp cache entry for a management host (marsgui) reachable from eth1, enter:

arp -v -H ether -i eth1 -s marsgui 00:05:9A:3C:78:00 pub

To remove the entry defined above, enter:

arp -v i eth1 -d marsgui nopub

date

To display or set the system date, use the date command.

date [newdate]

Syntax Description

Usage Guidelines

Time changes on the appliance are immediate, which can affect active incident correlation. If you change the time by greater than 30 minutes, you should restart your appliance to ensure that all processes synchronize using the new time.

Examples

The following example displays the current date:

[pnadmin]$ date

06/25/07

The following example changes the current date to March 12, 2008:

[pnadmin]$ date 03/12/2008

[pnadmin]$ date

03/12/2008

diskusage

To display the disk space available on all partitions, use the diskusage command.

diskusage

Syntax Description

There are no keywords, options, or arguments.

Usage Guidelines

Displays amount of disk space available on all partitions in the MARS Appliance

For all MARS Appliance models, the Oracle database has three partitions:

•/u01: Stores the Oracle binary files.

•/u02: Stores the data files.

•/u03: Stores the replay log files, which are cached, in-memory working files not yet committed to the data store.

If any of these partitions reaches 99% capacity, the Oracle database will experience operational issues.

The size of the data partition (/u02) varies based on the model:

•MARS 20: 74 GB

•MARS 50: 148 GB

•MARS 100: 565 GB

•MARS 200: 795 GB

Examples

To display the disk usage for all partitions in the MARS Appliance, enter the following command:

diskusage

The following is sample output for a MARS 100, as noted by the size of the /u02 partition:

Filesystem Size Used Avail Use% Mounted on

/dev/sda3 20G 5.7G 13G 31% /

/dev/sda1 129M 14M 108M 12% /boot

/dev/sda5 20G 4.8G 13G 26% /opt

/dev/sda6 20G 130M 18G 1% /log

/dev/sda7 29G 134M 27G 1% /pnarchive

/dev/sda8 20G 2.7G 16G 14% /u01

/dev/sda9 9.8G 2.2G 7.2G 23% /u03

/dev/sda10 565G 15G 522G 3% /u02

none 1005M 0 1005M 0% /dev/shm

dns

To display or specify the IP addresses of the Domain Name Services (DNS) servers that the MARS Appliance should use to resolve IP addresses into hostnames, use the dns command.

dns [primary] [secondary] [tertiary]

Syntax Description.

no keyword

The default behavior of this command displays the current set of IP addresses assigned to the primary, secondary, and tertiary DNS servers.

primary

Identifies the IP address of the DNS server that should be used first to resolve hostnames and/or IP addresses. Only the primary is required.

secondary

Identifies the IP address of the DNS server that should be used second to resolve hostnames and/or IP addresses. This address is optional. If this value is left blank, any previously defined secondary entries are deleted.

tertiary

Identifies the IP address of the DNS server that should be used last to resolve hostnames and/or IP addresses. This address is optional. If this value is left blank, any previously defined tertiary entries are deleted.

Related Commands

Displays the operational status of key components in the MARS appliance, including the Ethernet port numbers and their operational status.

exit

To log out of the system, use the exit command.

exit

Syntax Description

This command has no arguments or keywords.

Examples

The following command logs you out of the system:

exit

expert

To enable expert debugging mode on the MARS Appliance, use the expert command.

expert

Syntax Description

There are no keywords, options, or arguments.

Usage Guidelines

This command prompts the user to provide authentication credentials to enable the expert debugging mode. Only authorized Cisco support personnel can properly authenticate.

The expert command, undocumented before the 4.1.3, is for exclusive use by Cisco to aid in debugging customer issues that require direct access to the internal data store of the MARS Appliance. You may further restrict access to the expert command by setting the customer portion of the expert mode password via the passwd expert command. This command removes the default expert mode password set on the appliance from the factory.

While you can use the passwd expert command to restrict access to the expert command, only authorized Cisco support personnel are able to access the expert debugging mode of an appliance.

Usage Guidelines

Use the fips init command to activate the FIPS PCI Card, after which all cryptographic functions normally performed by the MARS operating system for Java security, SSH, SSL and TLS are offloaded to the FIPS PCI Card. The tamper-evident coating on the FIPS PCI Card, its encryption algorithms, and its security methods, conform to United States Government Federal Information Processing Standard FIPS 140-2 Level 2. The initialization process requires that three Smart Cards be initialized too, but the Smart Cards are not used in any subsequent MARS operations. After FIPS initialization, the MARS operates exactly as before, but with the following exceptions:

•The CS-MARS model number changes from CS-MARS-110R to CS-MARS-110RF

•With the FIPS PCI Card initialized, you must reboot the CS-MARS 110RF after executing a sslcert command.

•A Global Controller cannot parse information received from a CS-MARS-110RF

To manually destroy the FIPS cryptographic keys on the FIPS PCI Card, use the fips zeroize command. The zeroize option forces a reboot, and restablishes standard MARS encryptions. The zeroize option makes recovery of the FIP cryptographic keys impossible. After issuing a fips zeroize command, you must reinitialize the FIPS PCI Card to generate new FIPS keys and to reestablish FIPS 140-2 Level 2 security. The ability to manually destroy the cryptographic keys is a FIPS requirement. A fips init command zeroizes the FIPS PCI Card as part of the initialization process.

Use the fips status command to display the current operating status and version numbers of the FIPS PCI Card and its supporting software. The "Module #1" section refers to the physical FIPS PCI Card. The "Server" section refers to software that controls communication between MARS applications and the FIPS PCI Card. The server runs as a daemon on MARS. The FIPS security is in place when both the server and module (FIPS PCI Card) modes are operational. For more information on the CS-MARS FIPS PCI Card, see the CS-MARS FIPS PCI CARD Quick Install document at the following URL:

Use the show inventory command to verify that the FIPS PCI Card is physically installed. Use the model command to verify that the FIPS PCI Card is initialized (It is initialized when the model is CS-MARS-100RF).

Examples

The following show inventory command example verifies that the FIPS PCI Card is installed.

[pnadmin]$ show inventory

NAME: "Chassis", DESCR: "CS-MARS-110 Local Controller"

PID: CS-MARS-110, VID: V01, SN: M1100000011

FIPS HSM: nCipher nShield 500e, SN: 4F06-81E7-8838

<snip>

The following model command example shows the MARS model number as CS-MARS-110RF after intialization of the FIPS PCI Card (changed from model CS-MARS-110R):

[pnadmin]$ model

CS-MARS-110RF

The following example shows the output of fips status command.

[pnadmin]$ fips status

Server:

enquiry reply flags none

enquiry reply level Six

serial number 4F06-81E7-8838

mode operational

version 2.36.16

speed index 544

rec. queue 442..642

level one flags Hardware HasTokens

version string 2.36.16cam12, 2.33.82cam1 built on Mar 06 2008 15:55:03

Related Commands

Displays a complete list of available commands or usage of specific commands

-h

Many commands support the -h keyword (a.k.a. option) to display syntax usage

hostname

To set or show the hostname of the MARS Appliance, use the set hostname command.

hostname [hostname]

Syntax Description

no keyword

Displays the current hostname value, if defined. Otherwise, it displays no value.

hostname

Identifies the value to which the hostname for the MARS Appliance should be set.

Usage Guidelines

Changing the hostname requires that the appliance reboot. This reboot will occur automatically after your change the hostname. However, you are prompted to verify the hostname change. To cancel the hostname change without rebooting, enter no at the Hostname change will cause the system to reboot. Do you want to proceed? prompt.

Examples

This command sets the MARS Appliance name to csmars1:

hostname csmars1

To see the current hostname, enter:

hostname

hotswap

Use the hotswap command to remove and add hard drives to MARS Appliances with RAID arrays and to determine the physical layout of the hard drives. A hotswapremove and add command sequence must be executed before a hard drive is physically removed from or added to the RAID array.

hotswap list all

hotswap{add | remove}disk

Command History

Release

Modification

3.X

This command was introduced.

5.2.4

The list all keyword was added. The disk argument range of values include 0.

5.3.2

The list all keyword was modified to display the chassis hard drive slot to Port and PD number map; support for MARS 55 was added.

Syntax Description

list all

Displays a map of chassis hard drive slots and their related Port or PD number.

add

Indicates that the hard drive with the designated disk number is to be added to the RAID array.

remove

Indicates that the hard drive with the designated disk number is to be removed from the RAID array.

disk

Thechassis hard drive slot number of the hard drive to be hotswapped.

Usage Guidelines

To hotswap a hard drive is to replace the hard drive without powering down or rebooting the appliance.

To hotswap a hard drive, execute hotswapremovedisk, replace the hard drive in the slot designated by disk, then execute hotswapadddisk. Check the operational status of the hard drive and the RAID array with the raidstatus command.

Whenever a hotswapremovedisk command is executed, the hard drive in that slot is removed from the array and another must be added to restore full redundancy to the RAID array.

If the wrong disk value is entered, that hard drive is dropped from the RAID array, but can be rebuilt into the array without physically removing and inserting the hard drive by executing a hotswapadddisk command. It can take up to 300 minutes for a single hard drive to be rebuilt into the RAID array.

For more information on RAID hotswapping procedures, see the chapter, "System Maintenance" in the User Guide for Cisco Security MARS Local Controller at the following URL:

Related Commands

ifconfig

To display or modify the current IP address and network mask pairs associated with the network interfaces installed in the MARS Appliance, use the ifconfig command.

ifconfig{eth0 | eth1} ip_addressnetmask

Syntax Description

no keyword

Displays the current settings for both the eth0 and eth1 interfaces.

eth0

Identifies that you want to set the IP address/netmask value for the eth0 interface. This option cannot be used in conjunction with eth1. If you do not specify the ip_addr and netmask values, this option displays the current settings for the eth0 interface.

eth1

Identifies that you want to set the IP address/netmask value for the eth0 interface. This option cannot be used in conjunction with eth0. If you do not specify the ip_addr and netmask values, this option displays the current settings for the eth1 interface.

ip_address

Specifies the IP address to assign to the specified interface (eth0 or eth1). You must specify a netmask value following this value.

netmask

Identifies the network mask value to use with the address specified. You must specify the IP address before specifying this value.

Usage Guidelines

By default, the netstat command only displays status on active sockets that are not in the LISTEN state (that is, connections to active processes).The MARS netstat command is a partial implementation of the LINUX version.

nslookup

Look up the IP address or domain name using its counterpart. This command launches an interactive console that displays information that you can use to diagnose Domain Name System (DNS) infrastructure. Before using this tool, you should be familiar with how DNS works.

Syntax Description

nslookup puts you into interactive command mode. To quit the command mode and return to the command prompt, enter exit.

ntp

Use ntp server to identify the primary and secondary NTP server with which the appliance should synchronize. To force a synchronization with the NTP server, use ntp sync. To disable the use of ntp by this appliance, use ntp disable.

ntp server [ntp_server1] [ntp_server2]

ntp sync

ntp disable

Syntax Description

no keyword

Displays the current settings for the NTP servers. If no servers have been identified, it displays the message: ntp is not setup.

server

ntp_server1

Identifies the server, by IP address, that runs the NTP server from which you want this MARS Appliance to retrieve system time information. This time value sets the clock used to date and correlate events that are received by the appliance.

ntp_server2

sync

Forces the MARS Appliance to synchronize with the NTP server. If the first server is unreachable, the appliance attempts to synchronize with the secondary server.

disable

Disables the use of NTP on the MARS Appliance.

Usage Guidelines

The Network Time Protocol (NTP) synchronizes the clocks of computers across a network. By specifying an NTP server, you are instructing the appliance to contact that server to retrieve appropriate time settings. Synchronized times is especially important to MARS, because timestamp information provided by the reporting devices (and the appliance itself) is critical to accurate reconstruction of what transpires on the network.

Note Time changes on the appliance are immediate, which can affect active incident correlation. If you change the time by greater than 30 minutes, you should restart your appliance to ensure that all processes synchronize using the new time.

Warning When operating in a Global Controller/Local Controller hierarchy configuration, you must configure NTP on the Global Controller and on each Local Controller to ensure that rules fired by the Local Controller are properly propagated to the Global Controller.

Examples

To specify that 192.168.101.5 and 192.168.103.21 are your primary and secondary NTP servers, respectively, enter:

ntp server 192.168.101.5 192.168.103.21

To force a synchronization between the MARS Appliance and the NTP servers you have identified, enter:

Identifies the wait interval in seconds between each sent packet. The default is one second.

-I if_addr

Set source address to the specified interface address.

-l preload

If preload is specified, ping sends that many packets as fast as possible before falling into its normal mode of behavior. Only the super-user can use this option.

-L

Suppress loopback of multicast packets. This flag only applies if the ping destination is a multicast address.

-n

Numeric output only. No attempt will be made to look up symbolic names for host addresses.

-p pattern

You can specify up to 16 "pad" bytes to fill out the packet you send. This is useful for diagnosing data-dependent problems in a network. For example, "-p ff" will cause the sent packet to be filled with all 1s.

-Q tos

Set Quality of Service-related bits in ICMP datagrams. The tos value can be either decimal or hex number. Traditionally (RFC1349), these have been interpreted as 0 for reserved (currently being redefined as congestion control), 1-4 for Type of Service, and 5-7 for Precendence. Possible settings for Type of Service are minimal cost, 0x02; reliability, 0x04; throughput, 0x08; and low delay, 0x10. Multiple TOS bits should not be set simultaneously. Possible settings for special Precedence range from priority (0x20) to net control (0xe0). You must be root (CAP_NET_ADMIN capability) to use Critical or higher Precedence value. You cannot set bit 0x01 (reserved) unless ECN has been enabled in the kernel. In RFC2474, these fields have been redefined as 8-bit Differentiated Services (DS), consisting of bits 0-1 of separate data (ECN will be used, here), and bits 2-7 of Differentiated Services Codepoint (DSCP).

-q

Quiet output. Nothing is displayed except the summary lines at startup time and when finished.

-R

Record route. Includes the RECORD_ROUTE option in the ECHO_REQUEST packet and displays the route buffer on returned packets. Note that the IP header is only large enough for nine such routes. Many hosts ignore or discard this option.

-r

Bypass the normal routing tables and send directly to a host on an attached network. If the host is not on a directly attached network, an error is returned. This option can be used to ping a local host through an interface that has no route through it.

-spacketsize

Specifies the number of data bytes to be sent. The default is 56, which translates into 64 ICMP data bytes when combined with the 8 bytes of ICMP header data.

-t ttl

Set the IP Time to Live for multicasted packets. This flag only applies if the ping destination is a multicast address.

Select Path MTU Discovery strategy. hint may be either do (prohibit fragmentation, even local one), want (do PMTU discovery, fragment locally when packet size is large), or don't (do not set DF flag).

-U

Print true user-to-user latency (the old behavior).

-v

Displays verbose output.

-V

Displays the version of this command.

-w deadline

Specify a timeout, in seconds, before ping exits regardless of how many packets have been sent or received.

Usage Guidelines

This is standard LINUX implementation of the PING command.

Use Ctrl+C or ^C to stop the output of this command and return to the command prompt.

Note The options used in this command are case sensitive.

pndbusage

To display the percentage of total storage space used by the database, use the pndbusage command:

pndbusage

Syntax Description

There are no keyword, options or arguments for this command.

Usage Guidelines

This command displays the percentage used within the current partition, as well as specifies whether additional partitions are available. If no unused partitions exist, the command identifies which partition will be purged, provides an approximate schedule for when that purge will occur, and specifies the date range and total number of events scheduled to be purged.

Examples

Two possible outputs exist for this command:

•If empty partitions are available, the output appears as follows:

Current partition started on <start date> and uses

<number>% of its available capacity.

Switching to next partition is estimated for <estimated switching date>

<number> empty partitions are available for storage.

•If no empty partitions exists, the output appears as follows:

Current partition started on <start date> and uses

<number>% of its available capacity.

Switching to next partition is estimated for <estimated switching date>

<number> events, received between <purge start date> and <purge end date> will be
purged.

In this case, the third line indicates the data that will be purged on the <estimated switching date>.

Indents are displayed as shown above.

pnexp

Use the pnexp configuration mode to determine the time and disk space requirements for a data export, to review the size of the database and the data characteristics, to start and stop the export of configuration data, event data, or both, and to check the status of an ongoing export. To access the pnexp configuration mode, enter the pnexp command at the [pnadmin]$ prompt:

pnexp

Command History

Release

Modification

4.3.1

This command was introduced in the Local Controller and Global Controller version 4.x train.

4.3.4

Support for exporting to a SFTP server was added.

6.0.1

This command was implemented for all MARS hardware.

Syntax Description

help

Displays a list of valid subcommands.

quit | exit

Quit and exit the pnexp command. Return to the pnadmin command prompt.

status

Display the status of the current data export operation.

log {all | recent}

Show all or recent data exporting log entries.

data

Displays the number of events, report results, statistics, and incidents in the database.

config

Displays the number of devices, reports, and rules in the database. This command should be used as a point of comparison once the configuration is imported into the target appliance. Compare with the output of the pnimp config command.

stop

Stop the data export operation.

esti_time [MM/DD/YY:HH]

Estimates how much time and storage is required to export the event data that was received by MARS after a specified start time—only the events received after that time are migrated. If the last argument is not specified, then the estimate is based on all event data in the database.

Note The data export tool ignores data that was previously archived for the MARS Appliance. Each time the command is run, it writes data to a new NFS directory regardless whether data has already been archived.

export {config | data | all} {nfs_path} [MM/DD/YY:HH]

Export MARS configuration data ({config}), or events/reports/statistics/incidents data ({data}), or both ({all}) to the specified NFS or SFTP remote server path ({remote-path}). If the last optional argument is given, only data received after that time will be exported.

•Example export to NFS server:

export all 10.1.1.1:/mars/archive 02/28/07:00

The remote-path value identifies the IP address of the remote server plus the top-level archive folder on the remote server; it does not identify a specific archive date. The value format is [sftp:[<username>@]] IP_address:FolderPath . If sftp is not specified, a NFS server path is assumed.

•Example config only export to a NFS server:

export config 10.1.1.1:/archive

•Example data only export to a SFTP server:

export data sftp:10.1.1.1:/archive

If you export event data to an NFS server, the specified NFS path value must not match the archive path used by the source appliance. The pnexp command creates the proper archive folder under this path.

Note Only the start date is specified, the end date is always the current time (when event receiving is stopped).

Usage Guidelines

Use the pnexp command to prepare and export configuration and event data from a MARS Appliance running 4.x, or 5.x as separate data so you can import either or both on a MARS Appliance running 6.x software. When the export process begins, that MARS Appliance stops receiving events until the export process completes.

Note The export processstops other software module processes on the MARS Appliance (see pnstatus). To restart the modules, reboot the MARS Appliance with the reboot command.

The configuration export runs in the foreground displaying its status and errors immediately, where as event data export runs in the background. Use the log {all | recent} command to view the running status log for event data export.

The event export part of this operation can take a long time, as the export speed ranges between 6,000 and 30,000 events per second depending on the appliance model. Event data is exported in the following order: report result, statistics, incident and firing events, and event session. If the remote NFS server becomes unavailable during a lengthy export operation, the pnexp program attempts to remount the server. For event data export, logs are written to the /log/export.log file.

To exit pnexp configuration mode, enter exit at the pnexp> prompt.

For detailed explanations on data export, import, and migration, see the document, Migrating Data from Cisco Security MARS 4.x to 6.0.1, at the following URL:

Related Commands

Import configuration and event data into a MARS Appliance running version 5.3.1 or later.

pnimp

From the pnimp command prompt, you can access time required for a data import, review the size of the event data set on the NFS server, start and stop the import of configuration data or event data, and check the status of an ongoing import. To access the pnimp command prompt, use the pnimp command at the pnadmin prompt:

pnimp

Command History

Release

Modification

5.3.1

This command was introduced for the Local Controller and Global Controller operating Release 5.x

5.3.4

Support for importing from a SFTP server was added.

6.0.1

This command was implemented for all MARS hardware.

Syntax Description

help

Displays a list of valid subcommands.

quit | exit

Quit and exit the pnimp command. Return to the pnadmin command prompt.

status

Display the status of the current data import operation.

log {all | recent}

Show all or recent data import log entries.

data {remote-path}

Show how much data exists in the specified remote path, which is either a NFS or SFTP server.

config

Displays the number of devices, reports, and rules in the migration data set. This command should be used as a point of comparison after the configuration is imported into the target appliance. Compare with the output of the pnexp config command.

stop

Stop the data import operations.

esti_time {remote-path} {MM/DD/YY}

Estimates how much time is required to import the event, report, statistics, and incident data found at the specified remote path. The MM/DD/YYparameter restricts the estimate to data generated on or after that date.

Note This command does not estimate the time required to import configuration data.

import {config | data} {remote-path} [MM/DD/YY]

Import MARS configuration data ({config}), or events/reports/statistics/incident data ({data}) from the specified NFS or SFTP remote server path ({remote-path}). The last argument ([MM/DD/YY]) specifies the start date from which to begin importing events; all events from that date forward are imported. It is required for importing events/reports/statistics/incident data, meaning only importing data received or computed on or after that date. For importing config data, the latest MARS configuration data found under remote-path is used.

The remote-path value identifies the exported archive folder on the NFS or SFTP remote server; this path was dispayed when you ran the pnexp export command. The value format is [sftp:[<username>@]] IP_address:FolderPath . If sftp is not specified, a NFS server path is assumed.

Examples:

Example config only import from a NFS server:

import config 10.1.1.1:/archive

Example data only import from a SFTP server:

import data sftp:10.1.1.1:/archive

Note You must first import the corresponding configuration data before attempting to import the event, report, statistics, incident data for reporting devices.

Usage Guidelines

Use the pnimp command to import configuration and event data generated from a MARS Appliance running 4.3.6 or 5.x into a MARS Appliance running 6.x software. The import operation does not affect event processing; in other words, the received events are processed upon arrival. However, it does affect the web interface and the query and report features may experience long delays and missing event or session data.

Tip To avoid IP address conflicts, reconfigure the MARS Appliance running 4.x before you import its configuration data into a new appliance.

Note When you import configuration data, it overwrites the configuration running on the MARS Appliance and reboots the appliance. After rebooting, the MARS Appliance assumes the IP address, hostname, and username/password of the appliance from which the configuration archive was exported.

The configuration import runs in the foreground displaying its status and errors immediately, where as event data export runs in the background. Use the log {all | recent} command to view the running status log for event data import.

Recent data is imported first. If an NFS-related problem results in a file not being imported properly, the pnimp import program halts and logs an error to the /log/migrationrestore.log file.

The next time the import operation is started, you are prompted whether to retry the last failed file. If no, the import operation continues with the next file. If another problem occurs, for example, a file corruption, that prevents a file from being imported, pnimp import generates a log similar to "file es_334_...gz is imported with error!" and continue with the next file.

When the import operation completes, the Local Controller begins to rebuild the RAW message indices. You can use the web interface although keyword query will remain slow until the indices are rebuilt.

For detailed explanations on data export, import, and migration, see the document, Migrating Data from Cisco Security MARS 4.x to 6.0.1, at the following URL:

The most recent configuration archive from 4.3.5 release or later found on the NFS server
was created at 2008-09-04-11-25-10. Because events received after the config archive was
created may not be imported correctly later on when you try to import event data, so if
possible, you should always use 'pnexp' to export a fresh copy of configuration from the
Gen-1 MARS box before trying this command.

Do you wish to continue (yes/no) : yes

WARNING: this operation will overwrite current MARS box's configurations (both system and
DB) and reboot the machine. After reboot, current MARS box will take over the IP address,
hostname and MARS username/password of the MARS box from which the config archive was
exported, please make sure there will be no IP address conflict.

Do you wish to continue (yes/no): yes

!!! Stopping CS-MARS processes ...

Invoking binary config importing procedure ...

Recreating the database schema.

Importing data into database ...

Configuration data binary import done.

Configrestore succeeded!

!!! Updating system settings ...

Broadcast message from root (pts/5) (Wed Jun 13 15:23:46 2008):

The system is going down for reboot NOW!

[pnadmin]$

The following example specifies that the MARS Appliance should import the event data corresponding to the configuration data in the previous example:

Last imported configuration archive is from
192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10/2008-09-04/CF/cf-4318-431
_2008-09-04-11-25-10.pna created at 2008-09-04-11-25-10. Because events received after the
config archive was created may not be imported correctly, you should import a latest copy
of configuration from the Gen-1 MARS box before trying this command if possible.

Related Commands

Export configuration and event data from a MARS Appliance running version 4.x (4.3.1 or later).

pnlog

To set the logging level, to view log information at the console, or to email log files, use the pnlog commands. This command can specify the logging level of the MARS services, as well as the CheckPoint CPMI and LEA logs received by the MARS Appliance. Click on the pnlog command below to display its reference page.

pnlog mailto

To send an email with the log files appended, use the pnlog mailto command. set the logging level or to view log information at the console, use the pnlog command. This command specifies the logging level of the MARS services, as well as the CheckPoint CPMI and LEA logs received by the MARS Appliance.

pnlog mailto {[smtp_server] [sender] [recipient]}

Syntax Description

smtp_server

sender

recipient

Usage Guidelines

pnlog mailto {[smtp_server] [sender] [recipient]}

The pnlog mailto command is an alternative to sending a Feedback e-mail with the log files attached. It sends an e-mail from sender to recipient using smtp_server. The e-mail contains debugging information. These logs contain the logs specified above.

Examples

To send e-mail to bob@exmple.com from admin@example.com using the 192.168.101.5 mail server, enter:

Syntax Description

Usage Guidelines

Examples

Related Commands

pnlog setlevel

To set the logging level or to view log information at the console, use the pnlog command. This command specifies the logging level of the MARS services, as well as the CheckPoint CPMI and LEA logs received by the MARS Appliance.

pnlog setlevel {trace | debug | info | warning | error | critical}

pnlog setlevel cpdebug [ 0-9]

Syntax Description

no keyword

Displays command usage information.

trace

debug

info

warning

error

critical

setlevel debug

setlevel info

setlevel warning

setlevel error

setlevel critical

cpdebug [ 0-9]

Usage Guidelines

The pnlog setlevel command specifies how verbose the logs generated by the MARS Appliance services are, with trace being the most verbose and critical being the least. The default level is info. Unless you are actively debugging an issue, Cisco recommends that you use the default value. The trace and debug options should be used only on the advice of Cisco TAC. Setting a level of critical shows only the critical events, while setting a level of warning shows all warning or higher events (in other words, it shows warning, error, and critical events). The CLI sets a global output level while the web interface allows you to change this setting for each service (use pnstatus to view the list of services). You can access this setting in the web interface by selecting Admin > System Maintenance > Set Runtime Logging Levels.

pnlog setlevel cpdebug { 0 | 3 | 9 }

The pnlog setlevel cpdebug command sets the output level of the CheckPoint discovery process. You must specify one of three levels: 0, 3, or 9, where 0 disables Check Point debug logging, 3 enables all OPSEC debug logs, and 9 enables all CPMI debug logs. This command is used together with pnlog show cpdebug command to study the raw output of CheckPoint Discovery (CPMI) and CheckPoint Log (LEA) sessions. Cisco recommends the use of 9 for debugging and 0 when not actively debugging.

Examples

To set the log level of the MARS Appliance services to debug, enter.

pnlog setlevel debug

To set the log level of the CheckPoint discovery process to debug, enter:

pnlog setlevel cpdebug 9

Related Commands

pnlog show

To set the logging level or to view log information at the console, use the pnlog command. This command specifies the logging level of the MARS services, as well as the CheckPoint CPMI and LEA logs received by the MARS Appliance.

pnlog show {gui | backend | cpdebug}

Syntax Description

no keyword

Displays command usage information.

gui

backend

cpdebug

Usage Guidelines

pnlog show {gui | backend | cpdebug}

The pnlog show command provides running output of a particular logfile at the console. You can view one of three logfiles: the GUI logs, the backend logs (shows logs for the processes that the pnstatus command reports on), and CheckPoint debug logs. Press Ctrl+C to stop the output of this command.

When using cpdebug, you must set the pnlog setlevel cpdebug value to 3 or 9, as the default value of 0 turns off all CPE debug messages.

pnlog setlevel cpdebug { 0 | 3 | 9 }

The pnlog setlevel cpdebug command sets the output level of the CheckPoint discovery process. You must specify one of three levels: 0, 3, or 9, where 0 disables Check Point debug logging, 3 enables all OPSEC debug logs, and 9 enables all CPMI debug logs. This command is used together with pnlog show cpdebug command to study the raw output of CheckPoint Discovery (CPMI) and CheckPoint Log (LEA) sessions. Cisco recommends the use of 9 for debugging and 0 when not actively debugging.

Examples

To set the log level of the CheckPoint discovery process to debug, enter:

Related Commands

pnreset

To restore the appliance to the factory default settings (except for the pnadmin account) or to reset a Local Controller to standalone mode, use the pnreset command:

pnreset {-h} | {-g} | {-o} | {-j} | {-s}

Syntax Description

no keyword

Default. With no options pnreset restores the appliance to factory defaults and purges all configuration and event data (certificate and fingerprints stored to validate reporting devices, topology settings, archived logs, and the license key information).

-h

Displays usage information.

-g

Removes the Global Controller data from a Local Controller, leaving all Local Controller-specific data untouched.

-o

Resets the tnsnames.ora file to factory default. The tnsnames.ora file is required for the Oracle client to connect to the Oracle server.

-j

Resets the web server scheduler depending on Local Controller's running mode. A restart of web server is enforced.

-s

Resets a Local Controller to standalone mode. It removes the same data as the -g option, and in addition, removes the Global Controller connectivity data from the Local Controller and the default Global Controller zone information.

Command History

Release

Modification

4.1.0

This command was introduced with -g, -h, -o, and -j options.

4.2.2

The -s option was introduced.

Usage Guidelines

The pnreset Command Without Options

The pnreset command restores the appliance to factory settings by deleting system configuration and event data stored in the appliance database. This reset process can take between 30 and 60 minutes to complete, depending on the model of the appliance. The pnreset command does not reset the password that you have defined for the Administrator (pnadmin) account. To reset the password to factory defaults, you must re-image the appliance using the Recovery DVD.

Before entering the pnreset command without an option, disconnect the appliance from the network by unplugging the Ethernet cables from the appliance. Disconnecting from the network ensures that the cursor will return from the command upon completion. You must run pnreset without an option using a direct console connection, not an ssh console or other network-based connection. This requirement does not apply to pnreset when used with one of the options. For more information on console connections, see Establishing a Console Connection in the Cisco Security MARS Initial Configuration and Upgrade Guide, 6.X.

Caution Before executing the pnreset command without an option, write down the license key of the appliance. The license key is cleared during the resetprocess. You must provide this license key during the initial configuration following a reset operation, and it is not restored as part of archived data. This caution does not apply to pnreset when used with one of the options.

The -g Option

The -g option should be used only when a Global Controller recovery is required. The -g option keeps the Global Controller connectivity information on the Local Controller intact, enabling the Local Controller to reconnect as soon as the Global Controller is restored. To purge Global Controller information from the Local Controller, use the -soption.

The pnreset -g command clears the global inspection rules and global user accounts from the Local Controller, which prepares the Local Controller to be managed by the reimaged Global Controller. It does not remove the global user groups; instead they are renamed (appended with a date) and converted to local user groups. You can edit or delete these empty groups after the reset. Because user groups are often used as recipients for rule notifications, they are not deleted to avoid invalidating the Action definition of such rules.

The -o Option

Resets the tnsnames.ora file to factory defaults. The tnsnames.ora file is required for the Oracle client to connect to Oracle server. If MARS does not pull logs from the Oracle client, this option should never be used. If the tnsnames.ora file contains invalid data, MARS may be unable to connect to its internal Oracle database. This option should only be used when errors indicated that MARS has failed to setup an external Oracle server, errors are reported during that setup, and the pnstatus command fails to execute due to these connectivity issues.

Caution Do not use the -o option to troubleshoot all Oracle client issues. Using this command clears all Oracle client settings from the MARS Appliance, requiring that you re-enter all Oracle client setting using the web interface. Use this option only on direction from the Cisco TAC.

The -j Option

Resets the web server scheduler depending on the Local Controller's running mode. A restart of web server is enforced.

The -s Option

The -s option (4.2.2 and more recent) resets a Local Controller to Standalone mode from Monitor mode when the Global Controller cannot completely uncouple from (that is, delete) a Local Controller because of an unreliable network connection. It removes the same data as the -g option, removes the Global Controller connectivity data from the Local Controller, and removes the default Global Controller zone information. Use this option in the following cases:

•To reset a Local Controller when a Global Controller that was not running in archive mode crashes. If you plan to restore the Global Controller from an archive, use the -g option.

•If the Global Controller is not available or is unable to connect to the Local Controller, preventing you from successfully deleting the Local Controller entry from the Global Controller.

•If a Local Controller delete operation from the Global Controller fails.

Note If the Global Controller is operating properly and there is Global Controller-to-Local Controller connectivity, we recommend deleting the Local Controller entry from the Global Controller.

Examples

To restore the MARS Appliance to the factory defaults, enter:

pnreset

To prepare for a Global Controller reset or recovery, enter the following command on each Local Controller monitored by the Global Controller:

pnreset -g

To remove the Global Controller communication information and reset a Local Controller to standalone mode, enter the following command on the target Local Controller:

pnreset -s

Note You must also delete the Local Controller entry on the Global Controller.

Note While complete system configuration data is archived, the dynamic data that is archived includes only the data that is received or generated after you enable the data archive setting. Therefore, we recommend that you enable archiving before configuring your appliance to receive audit events from reporting devices.

Using the pnrestore command, you can restore three types of data:

•MARS OS—Restores the operating system (OS), including any upgrades that applied before the most recent archive was performed.

Note The version of MARS software running on the appliance to be restored must match the version recorded in the archive. For example, if the data archive is for version 4.1.4, you must re-image the MARS Appliance to version 4.1.4, not older or newer, before using the pnrestore command to recover the system configuration and events.

•System configuration data—Restores system configuration data, such as network settings, reporting devices, custom inspection rules, event types, reports, administrative accounts, archival settings, cases, and any other data that you have entered. It also, as of 4.2.1, includes the specific incident and event data associated with cases. It does not restore all dynamic data, just that data associated with cases.

•Dynamic data—Restores real event data that came from reporting devices, including incidents generated from events.

Note Prior to 4.2.1, performing a restore of just the configuration data resulted in incomplete data required to reconstruct existing cases: all open cases reference incidents and sessions. If this dynamic data is not restored, the cases could reference invalid incident and session IDs. To restore cases for releases prior to 4.2.1, you perform a full restore (mode 2).

Command History

Release

Modification

4.1.1

Mode 5 appears (-m 5 option).

5.2.4

End time (-e), stage path area (-s), and -r 1 options appear.

Syntax Description

No keyword or option

Displays the command's usage guidelines.

-m

Restoring mode. Three modes are available: 1 (default), 2, or 5. The mode determines what type of data is restored and from where the data is restored. Table 1-2 identifies what data is restored for each option.

Note Mode 5 restores from a backup in the local database; you cannot use it to restore from a NFS archive. As such, you not need to have archiving enabled to perform this restore operation. The configuration data is backed up every night on the appliance. Beware that if you upgrade to a newer release and attempt a restore before that configuration has been backed up, the restore will fail.

-h

Displays the detailed command's usage guidelines.

-t

Restores the data dated from this time through the most current archive date. Use mm/dd/yy:hh format. This option is required when you select mode r 2.

-e

(5.2.4 and later) Used in conjunction with -t and -s, this parameter allows you to specify the end time (endTime) of the data restore range. Used to restore a past range of data.

-s

(5.2.4 and later) Used in conjunction with -t and -s, this parameter allows you to specify the path (stagePath) on the NFS server to which to copy the range of data. This option is used to create a staging area from which you can restore a past range of data.

-p

Name of the directory where the archived data is stored. You must identify the NFS server by IP address, separated by a :/ and then the pathname NFSSeverIP:/archive_path.

Where NFSSeverIP is the value specified in the Remote Host IP field and archive_path is the value specified in the Remote Path field in the settings found in the web interface at Admin > System Maintenance > Data Archiving. For more information on these settings, see Configure the Data Archive Setting for the MARS Appliance.

-r 1

(5.2.4 and later) Used in conjunction with modes 3 and 4 only. Skips restoring the OS binary; instead only the configuration and dynamic data is restored. Because the version used to write out the archive for a particular time slice may predate the version most recently stored on the NFS server, these modes prevent MARS from overwriting the OS installed in the appliance to read the specified time slice's data.

1The incident and event data associated with cases is restored; however, other dynamic data is not.

2Mode 5 restores data from a local configuration file on the MARS Appliance, not an NFS server.

Examples

You can use the restore feature to complete different restoring tasks, such as:

•Perform a partial restore on the same MARS Appliance using the local backup of the configuration data; it essentially restores the previous days' configuration backup. Use the pnrestore command, mode 5. For example, in the CLI menu of the appliance, enter:

pnrestore -m 5

•Perform a partial restore on the same MARS Appliance using the archived data (including the OS and all data), but restoring only the event data generated since January 2, 2006 through the current date. Use the pnrestore command, mode 2. For example, in the CLI menu of the appliance, enter:

pnrestore -m 2 -p 192.168.1.1:/archive/CS_MARS1 -t 01/02/06:0

•Archive and restore data to the same MARS Appliance or a different MARS Appliance of the same model. From the appliance where you want to archive the data, use the GUI to configure archiving. From the appliance to which you want to copy the archived data, use the pnrestore command.

For example, if you only want to copy the OS and the system configuration data, you should use mode 1 of the restore command. For example in the CLI menu of the new appliance, enter:

pnrestore -m 1 -p NFSSeverIPOfOldBox:/archive/CS_MARS1

Caution When restoring Local Controller data, problems can arise if you attempt to restore dynamic data from a bigger appliance to a smaller appliance. In such cases, use mode 1.

•Create a staging area that contains a range of data and determine the correct version of MARS to use when restoring the selected data. Depending on the generation of hardware that generated the archive, pnrestore copies the data range to a target directory. Upon completion, pnrestore displays the version of MARS to use to stage the ranged restore as well as the correct restore parameter and NFS directory to use.

Note Upon completion of a staged restore, use the web interface to change the hostname, IP address, and license settings of the MARS Appliance to the appropriate values.

For example, if you want to stage data between 10/01/06 and 11/01/06 to the corresponding directory under the stageAreaPath directory, enter:

•Restore only the configuration and runtime data from October 1, 2006 at midnight to November 1 2006 at midnight, with the archive at 10.1.1.1 and the corresponding directory under the stageAreaPath directory at 10.1.10.15.

All services should be running on a Local Controller. However, a Global Controller only has four services running: autoupdate, graphgen, pnarchiver, and superV—all other services are stopped.

Syntax Description

This command has no arguments or keywords.

Examples

The following example displays the status of each module running on the MARS Appliance:

[pnadmin]$ version

6.0.1 (2955) 30

[pnadmin]$ pnstatus

Module State Uptime

DbIncidentLoaderSrv RUNNING 90-16:14:33

KeywordQuerySrv RUNNING 90-16:14:35

autoupdate RUNNING 90-16:14:34

csdam RUNNING 90-16:14:35

csiosips RUNNING 90-16:14:33

csips RUNNING 90-16:14:35

cswin RUNNING 90-16:14:33

device_monitor RUNNING 90-16:14:34

discover RUNNING 85-21:08:50

graphgen RUNNING 05:15:45

pnarchiver RUNNING 90-16:14:36

pndbpurger RUNNING 90-16:14:35

pnesloader RUNNING 90-16:14:36

pnmac RUNNING 90-16:14:36

pnparser RUNNING 74-13:09:55

process_event_srv RUNNING 49-17:54:26

process_inlinerep_srv RUNNING 90-16:14:35

process_postfire_srv RUNNING 90-16:14:36

process_query_srv RUNNING 90-16:14:36

securesyslog RUNNING 90-16:14:36

superV RUNNING 90-16:14:36

pnstop

To stop the MARS application running on the appliance from the serial console, use the pnstop command.

pnstop

Syntax Description

This command has no arguments or keywords.

Examples

The following command stops the MARS application running on the appliance:

pnstop

pnupgrade

To upgrade the software image running on the MARS Appliance, use the pnupgrade command. The pnupgrade command is not easily decipherable when presented in standard Cisco IOS command syntax; For this command page, it is parsed into more decipherable components.

The supported transport protocols are FTP, HTTPS, and HTTP. The CD-ROM and DVD methods access the MARS DVD drive.

For the FTP, HTTPS, and HTTP methods, you can configure a specific port number instead of relying on the default port number for that service.

You can also specify a login and password as part of the URL syntax instead of using the -u option.

Note When using the HTTPS syntax, if the certificate of the upgrade server changes between upgrades, you are prompted by pnupgrade to accept the new certificate before the upgrade continues.

Table 1-3 discusses usage guidelines for some of the pnupgrade options.

Table 1-3 Usage Note—pnupgrade Command Options

Command Option

Usage Notes

-d (desist)

If the upgrade package being applied requires a system reboot, the -d option displays a confirmation-to-continue prompt before proceeding with the upgrade. This allows you to cancel the upgrade before it begins.

-n (no timeout)

Overrides the timeout of the upgrade script.

In some instances, the time to complete an upgrade task can exceed the system allocated timeout, causing the upgrade to terminate (For example, some data upgrade packages require extensive database integrity checks). The -n option allows the upgrade to run to completion.

Caution Cisco cautions against using the -n option on the first upgrade attempt.

-p (preempt)

The -p option terminates any in-progress upgrade then runs the upgrade with the package specified in the command line.

An upgrade can be in-progress but not apparent from an SSH session. For example, if the SSH session that initiated an upgrade is terminated during the upgrade, some CLI-related upgrade processes are closed but backend upgrade processes continue to run. If another pnupgrade command is issued through a new SSH session, thats upgrade will be rejected unless the -p option is used to terminate the upgrade still running. The newest upgrade begins immediately after the still running upgrade is terminated.

The login and password required by the proxy server. Use -U together with the -x option.

-x (proxy server address and port number)

The IP address and port number of the proxy server. Use the -U option if a login and password are required.

Upgrade Log File

The pnupgrade -l command displays a log of each step that was performed during the most recent upgrade. This log file can identify which steps failed or hung in a failed upgrade attempt.

Image Management Troubleshooting

If the upgrade is done with the GUI, any errors encountered are prominently displayed in the Upgrade Status Logs section.

For CLI upgrade errors, check the pnupgrade -l log file first. Cisco TAC can check for the existence of any other failed upgrade log files with the expert password.

For Global Controller and Local Controller image management problems, make sure that the status for each Local Controller status is "Active." If it is not "Active," then go to Admin -> LC Management for more troubleshooting information.

Examples

The following example displays the upgrade log file:

[pnadmin]$pnupgrade -l

The following example specifies username "aladdin" and password "opensesame" to authenticate to the HTTPS Internal Upgrade Server "10.1.1.2" using default port numbers. The upgrade package is retrieved from the "/packages" directory:

The following example specifies the username "ybother" without a password to authenticate to the HTTPS Internal Upgrade Server using default port numbers. The upgrade package is retrieved from the "/packages" directory:

The following example specifies the proxy server "myproxy" to retrieve the upgrade file from the default directory of the Internal Upgrade Server "10.1.1.1" using HTTP on default ports (both proxy and Internal Upgrade Server). The username "myname" and password "mypass" authenticate to the proxy server; The login "me" with no password authenticates to the Internal Upgrade Server:

raidstatus

To view the status of the RAID array and of the individual hard drives, use the raidstatus command.

raidstatus

Syntax Description

This command has no arguments or keywords.

Command History

Release

Modification

4.2.1

This command introduced for Generation 1 hardware

5.2.4

This command was introduced for Generation 2 hardware

5.3.2

Support for the MARS 55 was added.

Usage Guidelines

The raidstatus command is used with the hotswap command to replace component hard drives of the MARS Appliance Raid array.

For information on RAID hotswapping procedures and hard drive alerts, see the chapter, "Hardware Maintenance Task" in the Cisco Security MARS Hardware Installation and Maintenance Guide 6.X at the following URL:

In the following example, the MARS 210 RAID array is shown degraded because hard drive 3 (p3) has failed. The RAID array is functional, but not fully redundant because the p2+p3 RAID 1 pair is compromised.

In the following example, hard drive 3 has been replaced with the hotswap command, and is being rebuilt into the the MARS 210 Raid Array. The Array remains degraded until p3 has Online status. The progress message at the bottom shows percentage complete and time elapsed in the rebuild process.

The two drives in each RAID 1 subunits have unique physical port numbers.

The RAID 1 subunit status values are as follows:

•OK—The subunit is in good order and operating at optimal efficiency.

•Rebuilding—The subunit is being rebuilt, efficiency is not yet optimal.

•Degraded—At least one physical disk in the array cannot be accessed.

The rebuild processes can take between 90 minutes and two hours to complete, depending on the amount of data on the disk. Subunits are rebuilt one subunit at a time. The percentage complete indicator tells you which subunit is currently being rebuilt.

The Physical Port number appears as N/A when the associated drive bay is empty.

Individual drive status is shown in the CBOD: field. CDBOD status can be OK or DEGRADED.

Syntax Description

Examples

Related Commands

Predicts the duration of the file system check that will occur if the Cisco Security MARS is rebooted.

route

The route command manipulates the MARS Appliance's IP routing tables. Its primary use is to set up static routes to specific hosts or networks via an interface after it has been configured with the ifconfig command.

When the add or del options are used, the route command modifies the routing tables. Without these options, the route command displays the current contents of the routing tables.

I Set the initial round trip time (irtt) for TCP connections over this route to I milliseconds (1-12000). If omitted, the default value is 300ms.

mms M

Set the TCP Maximum Segment Size (MSS) for connections over this route to M bytes. The default is the device MTU minus headers, or a lower MTU when path mtu discovery occurred.

mod, dyn

Reinstate install a dynamic or modified route. These flags are for diagnostic purposes, and are generally only set by routing daemons.

-n

Display numeric values for addresses; don't resolve hostnames.

-net

Identifies the route as a network route.

netmask

Network mask that corresponds to the ip_addr value.

reject

Install a blocking route, which forces a route lookup to fail. Use this feature, for example, to mask out networks before using the default route. Do not use for firewalling.

target

IP address of the host or network for which you are defining a route.

-v

Display verbose information.

window W

Set the TCP window size for connections over this route to W bytes.

Usage Guidelines

The route command is a standard Linux command.

script

Use the restricted script command mode to execute provided script:

script [-b] program

Syntax Description

-b

program

Identifies the name of the script to run.

Command History

Release

Modification

4.3.1

This command was introduced in the 4.3.1 release.

5.3.1

This command was introduced in the 5.3.1 release.

Usage Guidelines

The following scripts are available from the restricted script command mode:

•get_mars_summary_info.sh— Gather high level statistics about the configuration and topology for the MARS Appliance.

Examples

The following example gathers high level statistics about the MARS Appliance's configuration and topology.

[pnadmin]$ script get_mars_summary_info.sh

Collecting MARS summary info from the DB in HTML format

Started at Fri Sep 14 05:50:10 PDT 2007

Use 'pnlog mailto' command to include it in the logs

This may take several minutes to complete. Use Ctrl+C in case you need to interrupt.

Completed at Fri Sep 14 05:50:10 PDT 2007

[pnadmin]$

show healthinfo

To display the operational status of key components in the appliance use the showhealthinfo command.

show healthinfo

Syntax Description

There are no arguments or keywords for this command.

Command History

Release

Modification

5.2.4

This command was introduced for the MARS 25R, 25, 55, 110R, 110, 210, GC2R, and GC.

6.0.1

This command was introduced for the MARS 20, 50, 100E, 100, 200, GCM, and GC.

Usage Guidelines

The show healthinfo command displays the operational status of critical components, such as fans, CPUs, hard drives, Ethernet interfaces, power supplies, backup battery units, memory usage, and the operating system.

Power Supply

In the command output for Power Supply, PS1 is the lower power supply, PS2 is the upper power supply. In normal operation, PS1 supplies most of the power requirements, and PS2 is the redundant power supply.

Ethernet Card Status

In the command output for Ethernet, eth0 is integrated NIC 1, eth1 is integrated NIC 2; eth2 and eth3 are not supported.

Raid Battery Backup Unit

In the command output for BBU, the relative state of charge is directly proportional to the battery backup time (100%charge = 72hours ).

For more information on RAID BBU and power supply procedures, see the chapter, "Hardware Maintenance Tasks—MARS 55, 110R, 110, 210, GC2R, and GC2" in the Cisco Security MARS Hardware Installation and Maintenance Guide, 6.X at the following URL:

sslcert

To generate a new self-signed SSL certificate and reboot the JBoss Application Server use the sslcert command:

sslcert

Syntax Description

There are no kewords, arguments or options for this command.

Usage Guidelines

To use this command, you will be prompted to provide the following information:

•The common name of the MARS Appliance

•The name of your organizational unit (OU)

•The name of your organization (O)

•The name of your City or Locality (L)

•The name of your State or Province (SP)

•The two-letter country code for the unit (C)

The sslcert command launches an interactive program that collects the information required to generate a certificate. You are prompted to verify that you want to generate a new self-signed certificate. Enter YES to begin the interview process that will collect the data required to generate the certificate. Enter NO to cancel without generating a new certificate.

With the FIPS PCI Card installed and initialized, you must reboot after executing an sslcert command.

Examples

The following command generates a new self-signed certificate:

[pnadmin]$ sslcert

Sslcert command will generate a new ssl certificate and restart jboss.

Usage Guidelines

The syslogrelay setcollector command allows you to specify the IP address of the syslog server to which syslog messages should be forwarded. This command must be used in conjunction with the syslogrelay src command, which designates the reporting devices for which syslog messages should be forwarded.

Examples

The following example specifies that the Local Controller should forward the syslog messages to 192.168.1.25, which is the designated address of the collector.

[pnadmin]$ syslogrelay setcollector 192.168.1.25

The following example changes the address of the collector defined in the previous
example.

Command History

Syntax Description

Indicates that syslog messages received by MARS from the listed IP addresses to be relayed to the configured collector.

exclude

Indicates that syslog messages received by MARS from the listed IP addresses should not be forwarded to the configured collector.

ANY

Adds all IP addresses to the selected source list.Used in conjunction with either the include or exclude parameter.

ip_address1, . . . ip_address10

Indicates between one and ten IP addresses in a comma separated list. Used in conjunction with the include and exclude parameters. You can only add up to ten addresses at one time; however, you can use the command repeatedly to add to the list.

reset

Clears the active syslog relay source configuration—both the include and exclude lists. If a syslog relay source is configured, the following prompt appears:

One or more device addresses are currently configured. Proceed
further? [yes/no]:

Enter yes to clear the source configuration or no to cancel.

Usage Guidelines

The syslogrelay src command designates the set of reporting devices for which the Local Controller forwards the syslog messages it receives to the collector. You can exclude all addresses, defining the few exceptions for which the syslog messages should be forwarded; or you can enable all addresses, and define the exceptions that should not be forwarded.

The ANY token cannot be used simultaneously in both the include and exclude lists. If the value is set on one list, and you apply it to the other list, it is removed from the first.

The syslogrelay src include ANY command indicates that all syslog messages received by MARS be relayed to the configured collector, excepting those that originate from the addresses configured as exclusions. If exclusions are configured, the following prompt appears:

One or more device ip addresses are currently excluded. Proceed further? [y/n]:

Enter y to retain the current exclusions and forward the syslog messages of from all other reporting devices, or enter n to cancel.

The syslogrelay src exclude ANY command indicates that all syslog messages received by MARS should not be forwarded to the configured collector, excepting those that originate from addresses configured as inclusions. If inclusions are configured, the following prompt appears:

One or more device ip addresses are currently included. Proceed further? [y/n]:

Enter y to retain the current inclusions and prevent the forwarding of syslog messages from all other devices, or enter n to cancel.

Examples

The following example specifies that the Local Controller should forward the syslog messages it receives from any reporting device to the collector (as long as the source IP address of the message is not in the source exclude list).

[pnadmin]$ syslogrelay src include ANY

The following example specifies that the Local Controller should not forward the syslog messages it receives from 192.168.1.1 or 192.168.2.1 to the collector.

[pnadmin]$ syslogrelay src exclude 192.168.1.1, 192.168.2.1

The following example clears the source include and exclude lists of all values:.

[pnadmin]$ syslogrelay src reset

One or more device ip addresses are currently configured. Proceed further?[yes/no]: yes

List syslog relay configuration. Displays the list of IP addresses used by the syslogrelay. This list includes the collector, as well as reporting devices in the include and/or exclude lists.

syslogrelay list

To display the IP addresses of the reporting devices to which the Local Controller forwards the syslog messages as well as the IP address of the collector to which they are sent, use the syslogrelay list command.

syslogrelay list [all | collector | src]

Command History

Release

Modification

4.3.1

This command was introduced in the 4.X release train.

5.3.1

This command was introduced in the 5.X release train.

Syntax Description

-h

Displays usage guidelines

all

(default) Displays the IP address of the collector and the union of those sources on the include list and exclude list.

collector

Displays the IP address of the collector, or destination, of the forwarded messages.

src

Displays the IP addresses of the sources on the include list and exclude list.

Usage Guidelines

Using the syslogrelay list command, you can verify the list of addresses in the include and exclude lists. If a reporting device device appears in the include list, the Local Controller forwards any syslog messages that it receives from that device to the syslog collector. The exclude list identifies the IP addresses for which the Local Controller does not forward the syslog messages. The collector identifies the IP address to which the specified syslog messages are forwarded. This address represents a syslog server or other collector as defined in RFC 3164: The BSD syslog Protocol.

If the collector address is not set, the syslogrelay feature is disabled.

Add to, exclude from, or clear the list of IP addresses for which the Local Controller forwards syslog messages to the collector.

sysstatus

To view the current CPU activities, enter:

sysstatus -hvbcisqS -d delay -p pid -n iterations

Syntax Description

no keyword

Displays the current CPU activities.

-h

Displays the detailed command's usage guidelines.

-d

Specifies the delay between screen updates. You can change this delay using the -s interactive command.

-p

Monitors only those processes with the given process id. This flag can be given up to twenty times. This option is not available interactively.

-q

This causes sysstatus to refresh without any delay.

-S

Specifies cumulative mode, where each process is listed with the CPU time it has spent. It also lists the CPU time of the dead children for each process.

-s

Tells sysstatus to run in secure mode. This option disables the potentially dangerous interactive commands.

-i

Start sysstatus ignoring any idle or zombie processes.

-C Display total CPU states in addition to individual CPUs. This option only affects SMP systems.

-c

Display the command line instead of the command name only. The default behavior has been changed as this seems to be more useful.

-n

Number of iterations. Update the display this number of times and then exit.

-b

Batch mode. Useful for copying output from sysstatus to a file. In this mode, sysstatus does not accept command line input. It runs until it reaches the number of iterations specified by the n option or until killed. Output is plain text suitable for display on a dumb terminal.

Usage Guidelines

The sysstatus command is a system-defined alias for the Linux top command, which displays and updates information about the top CPU processes. It provides a real-time view of the processor activity. It lists the most CPU-intensive tasks on the system, and can provide an interactive interface for manipulating processes. It can sort the tasks by CPU usage, memory usage, and runtime.

If you execute the command and you do not select the batch mode option, you are running in an interactive environment. In this environment, you can interact with the output as follows:

•Press H or ? to get the list of interactive commands.

•Press the space key to refresh the data immediately.

•Press Ctrl+L to erase and redraw the screen.

•Press K to kill a specific process ID (pid).

•Press Q to quit viewing the real-time data and return to the command prompt.

•Press Ctrl+C to break the batch mode display.

•Press I to toggle ignoring idle and zombie processes.

•Press N or # to specify the number of processes to display on the screen. The value of zero (0) restores the default, which is the number of processes that fit on the screen.

•Press S to toggles the cumulative mode, the equivalent of -S, that includes a process's defunct children as part of the CPU times.

•Press f or F to add fields or remove fields from the display.

•Press o or O to change the order of the displayed fields.

•Press L to toggle the display of load average and uptime information.

•Press M to toggle the display of memory information.

•Press T to toggle the display of processes and CPU states information.

•Press C to toggle the display of command name or full command line.

•Press N to sort the tasks numerically by pid.

•Press A to sort the tasks by age (newest first).

•Press P to sort the tasks by CPU usage (default).

•Press M to sort the tasks by resident memory usage.

•Press T to sort the tasks by time/cumulative time.

tcpdump

Tcpdump prints to the console the headers of packets on a network interface that match the boolean expression. Exit with Ctrl+C.

Syntax Description

Dumps all headers of packets on the network interface to the terminal in real time.

-c count

Exit after receiving count number of packets.

-i interface

Identifies the interface to sniff.

-s snaplen

Snarf snaplen bytes of data from each packet rather than the default of 68.

-Ttype

Force packets selected by expression to be interpreted the specified type.

Types are:

•cnfp (Cisco NetFlow protocol)

•rpc (Remote Procedure Call)

•rtp (Real-Time Applications protocol)

•rtcp (Real-Time Applications control protocol)

•snmp (Simple Network Management Protocol)

•vat (Visual Audio Tool)

•wb (distributed White Board).

-U user

Drops root privileges and changes user ID to user and group ID to the primary group of user.

expression

Species which packets are dumped. If no expression is specified, all packets are dumped. Otherwise, only packets for which expression is `true' will be dumped.

-h

Displays the detailed command's usage guidelines.

Usage Guidelines

Ctrl+C exists the tcpdump screen.

Note For more information on this command and its use, please refer to a Linux command reference or man page.

telnet

The telnet command is used to communicate with another host using the TELNET protocol. In this mode, it accepts and executes the commands listed below. If it is invoked with arguments, it performs an open command with those arguments.

Syntax Description

Specifies an 8-bit data path, which forces telnet to attempt to negotiate the BINARY option on both input and output.

-E

Stops any character from being recognized as an escape character.

-L

Specifies an 8-bit data path on output. This causes the BINARY option to be negotiated on output.

-a

Attempt automatic login. The name used is that of the current user.

-b hostalias

Uses bind on the local socket to bind it to an aliased address (see ifconfig and the "alias" specifier) or to the address of another interface than the one naturally chosen by connect. This can be useful when connecting to services which use IP addresses for authentication and reconfiguration of the server is undesirable (or impossible).

-c

Disables the reading of the user's .telnetrc file.

-d

Sets the initial value of the debug toggle to TRUE.

-e escapechar

Sets the initial telnet escape character to escapechar. If escapechar is omitted, there will be no escape character.

-l user

When a host connects to the remote system, if the remote system understands the ENVIRON option, the user will be sent to the remote system as the value for the variable USER. This option implies the -a option. This option may also be used with the open command.

-n tracefile

Opens tracefile for recording trace information.

-r

Specifies a user interface similar to rlogin. In this mode, the escape character is set to the tilde (~) character, unless modified by the -e option.

hostname

Indicates the official name, an alias, or the Internet address of a remote host.

port

Indicates a port number (address of an application) used to connect on the remote host. If a number is not specified, the default telnet port is used.

Usage Guidelines

For more information on this command and its use, please refer to a Linux command reference or man page.

time

To display the current time, enter:

time

To set the time to 11:15 p.m., enter:

time [hh:mm:ss]

Syntax Description

hh:mm:ss Identifies the time in hh:mm:ss format, where hh is 01-24, mm is 00-59 and ss is 00-59.

Usage Guidelines

Time changes on the appliance are immediate, which can affect active incident correlation. If you change the time by greater than one half hour, you should restart your appliance to ensure that all processes synchronize using the new time.

timezone

When configuring a Global Controller\Local Controller hierarchy, you should ensure that all the Local Controllers are set to the same timezone as the reporting devices that they are monitoring.

Note Time changes on the appliance are immediate, which can affect active incident correlation. If you change the time by greater than 30 minutes, you should restart your appliance to ensure that all processes synchronize using the new time.

Syntax Description

set Displays a menu system that allows you to select the appropriate timeszone based on continent/country/region or using the POSIX TZ format.

Examples

The following example displays the current time of a MARS 200:

[pnadmin]$ timezone

17:04:40

PDT -0700

The following example sets the timezone to Pacific time:

[[pnadmin]$ timezone set

Please identify a location so that time zone rules can be set correctly.

Syntax Description

Usage Guidelines

Traces the route that IP packets take from the MARS appliance to another host on a network by listing the intermediate gateways that the packet traverses to reach the host.

Traceroute displays the IP address and hostname (if possible) of the gateways along the route taken by the packets. Traceroute is used as a network debugging tool. If you are having network connectivity problems, traceroute will help you diagnose where the trouble might exist along the route.

Use the traceroute command to discover the routes that packets take, when traveling to their destination.Specify a hostname or an IP address as an argument to this command.

This command works by taking advantage of the error messages generated by routers when a datagram exceeds its time-to-live (TTL) value.

The traceroute command starts by sending probe datagrams with a TTL value of one. This causes the first router to discard the probe datagram and send back a "time-exceeded" error message. The trace command sends three probes at each TTL level and displays the round-trip time for each.

The traceroute command sends out one probe at a time. Each outgoing packet may result in one of the following messages:

A "time-exceeded" error message - This indicates that an intermediate router has seen and discarded the probe, when the TTL was decremented to zero.

A "destination-unreachable" error message - This indicates that the destination node has received the probe and discarded it because it did not have a route to the destination.

An "*" - If a timeout occurs before a response comes in, an asterisk (*) is displayed.

An "invalid-port" error message - This indicates that the destination node received the trace message, which was addressed to an invalid port.

The traceroute command terminates when the destination is reached, when the maximum TTL is exceeded, or when the user interrupts the trace with the <Ctrl>-<Shift>-6 sequence.

unlock

Use the unlock command to restore access to the MARS Appliance GUI for all or specified user accounts after login failures.

unlock {-a }| {{-l | -g | -b } login_name}

Command History

Release

Modification

4.3.1/5.3.1

This command was introduced.

Syntax Description

-a

Unlocks all accounts on the MARS Appliance.

-l

Unlocks the local account for the specified login name.

-g

Unlocks the global account for the specified login name.

-b

Unlocks global and local accounts for the specified login name.

login_name

Specifies the login name of the account to be unlocked.

Usage Guidelines

For both Local or AAA authentication methods, GUI access is prevented (locked) for an account upon login failure, which occurs when a specified number of incorrect password entries are made for a single login name. The administrator GUI access can be locked like any other account.

The CLI access through the console or through SSH is never locked. The unlockCLI command can unlock GUI access for some or all accounts.

Unlocking is not replicated through Global Controller-Local Controller communications, it applies only to the local appliance. An account locked on a Global Controller does not replicate the locked status to global accounts on Local Controllers. A global account locked on two different appliances must be unlocked manually on each appliance.